autocrm/app/Providers/Filament/TenantPanelProvider.php

<?php

namespace App\Providers\Filament;

use App\Http\Middleware\CheckTenantStatus;
use App\Http\Middleware\ResolveTenant;
use Filament\Http\Middleware\Authenticate;
use Filament\Http\Middleware\AuthenticateSession;
use Filament\Http\Middleware\DisableBladeIconComponents;
use Filament\Http\Middleware\DispatchServingFilamentEvent;
use Filament\Pages\Dashboard;
use Filament\Panel;
use Filament\PanelProvider;
use Filament\Support\Colors\Color;
use Filament\View\PanelsRenderHook;
use Illuminate\Support\Facades\Blade;
use Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse;
use Illuminate\Cookie\Middleware\EncryptCookies;
use Illuminate\Foundation\Http\Middleware\VerifyCsrfToken;
use Illuminate\Routing\Middleware\SubstituteBindings;
use Illuminate\Session\Middleware\StartSession;
use Illuminate\View\Middleware\ShareErrorsFromSession;

/**
 * Tenant panel — served on every <slug>.service.mir.md.
 * ResolveTenant middleware loads the current Company before any auth check.
 */
class TenantPanelProvider extends PanelProvider
{
    public function panel(Panel $panel): Panel
    {
        return $panel
            ->id('tenant')
            ->path('app')
            ->login()
            ->brandName('AutoCRM')
            ->colors([
                'primary' => Color::Blue,
            ])
            ->authGuard('web')
            ->discoverResources(in: app_path('Filament/Tenant/Resources'), for: 'App\\Filament\\Tenant\\Resources')
            ->discoverPages(in: app_path('Filament/Tenant/Pages'), for: 'App\\Filament\\Tenant\\Pages')
            ->pages([
                Dashboard::class,
            ])
            ->discoverWidgets(in: app_path('Filament/Tenant/Widgets'), for: 'App\\Filament\\Tenant\\Widgets')
            ->widgets([
                \App\Filament\Tenant\Widgets\StatsOverview::class,
                \App\Filament\Tenant\Widgets\FinanceOverview::class,
                \App\Filament\Tenant\Widgets\LowStockTable::class,
            ])
            ->middleware([
                // CRITICAL: tenant resolution must run BEFORE Filament's
                // Authenticate middleware (which is inserted by authMiddleware
                // between ShareErrorsFromSession and AuthenticateSession).
                // Otherwise User::find() during auth check has no tenant
                // context → TenantScope returns 0 rows → user appears
                // unauthenticated → endless redirect to /app/login.
                ResolveTenant::class,
                CheckTenantStatus::class,
                EncryptCookies::class,
                AddQueuedCookiesToResponse::class,
                StartSession::class,
                AuthenticateSession::class,
                ShareErrorsFromSession::class,
                VerifyCsrfToken::class,
                SubstituteBindings::class,
                DisableBladeIconComponents::class,
                DispatchServingFilamentEvent::class,
            ])
            ->authMiddleware([
                Authenticate::class,
            ])
            // PWA + theming injection
            ->renderHook(
                PanelsRenderHook::HEAD_END,
                fn (): string => Blade::render(<<<'BLADE'
                    @php
                        $t = app(\App\Tenancy\TenantManager::class)->current();
                        $themeColor = $t?->settings['theme_color'] ?? '#3B82F6';
                        $name = $t?->display_name ?? $t?->name ?? 'AutoCRM';
                    @endphp
                    <link rel="manifest" href="/manifest.json">
                    <meta name="theme-color" content="{{ $themeColor }}">
                    <meta name="apple-mobile-web-app-capable" content="yes">
                    <meta name="apple-mobile-web-app-status-bar-style" content="default">
                    <meta name="apple-mobile-web-app-title" content="{{ $name }}">
                BLADE)
            )
            ->renderHook(
                PanelsRenderHook::BODY_END,
                fn (): string => <<<'HTML'
                    <script>
                    if ('serviceWorker' in navigator) {
                        window.addEventListener('load', () => {
                            navigator.serviceWorker.register('/sw.js').catch(() => {});
                        });
                    }
                    </script>
                HTML
            );
    }
}